More to the point this should never have happened.
Calling it a "Russian" company would be totally inaccurate. The hack that I saw cited, though I believe it was an unidentified source, was one that was injected at compile time. That would be very difficult to notice for any programmer.
So, here's my question:
Why did you refer to them as "Russian" when it's obviously not true?
"Among its customers is SolarWinds, JetBrains Chief Executive Maxim Shafirov said from St. Petersburg, Russia, where JetBrains has offices."
https://www.reuters.com/article/us-global-cyber-jetbrains/fb...
I mean everything might be above board but it's probably bad or lax US policy and/or regulations that Solarwinds was deployed through out the government.
Does the government need to be scrupulous in whatever open and closed source software it chooses to vend? Yes. Do we need to be chiding about the motivations of every day Russians as one of our first order investigations? Probably not.
I can only go off of what you put in plaintext.
> The real problem is the threat vector
So, explain to me the threat vector. If we have a threat vector that is substantiated by, "is Russian" then I think we have a problem. If we have a threat vector of, "Government vets first order software dependencies, but not the second order and soft dependencies of software vendors" then we have something more akin to analysis.
It took Kaspersky being affiliated with, cooperating (and serving) the FSB in order for it to be banned, not because it was established by Russians.
> Russian intelligence
Someone will need to prove that there is a link between JetBrains as a company and Russian intel (aka the FSB) just as what happened with Kaspersky. I doubt that this is the case. It could certainly be a rogue employee, but that's a good amount of speculation. We've seen that the FSB has no issue hacking into companies and organizations without a mole.
> and a lack of due diligence.
I described the attack. What due diligence protects against something that injects itself during compile time and only triggers on specific events?
Kasperkey is even more obvious because the founder was involved with the KGB even before the 2017 ban. It should never have been used. Now maybe Kasperkey's affiliation is akin to a "communist youth party" card and not necessarily a genuine affiliation but the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe.
Are you getting this from somewhere or are you explaining how you perceive the standards?
The laws I'm familiar with generally have to do with pretty specific criteria for delivering software that touches specific types/classifications of data. None of that would've caught how the JetBrains software was allegedly used to exploit the SolarWinds product. This was some pretty sophisticated stuff.
Or something like that.
Maybe have them answer some other questions about the articles other than just accuracy, such as quality of writing, in order to be less likely to cause them to re-consider how they are estimating accuracy?
And I suppose by “accuracy” I mean to also include “not misleading”, in addition to just “not false”.
I know it's a meme to bring up Gell-mann amnesia here, but I will raise it as a basic test for quality in journalism.
When NYT writes about something I know about, I almost always have serious problems with it. Jetbrains in particular. And honestly some of the writing is so bad that even without knowing about the subject, I can tell it is crap, like the article about the SlateStarCodex. I had never read it before that post, but had heard it mentioned in passing. Also, NYT Opinion is Hannity/Shapiro level crap and should be dumped. Stick to the facts please.
On the other hand, The Economist has consistently impressed me; I read/listen with a critical ear and they do a wonderful job even with very niche topics. I've worked on some AR tech and they had a special report that just really nailed it and got into the weeds. Every time I thought "but they didn't mention..." they would mention or clarify a paragraph later.
Economist has a liberal viewpoint and they're not shy about it. I prefer that approach and accept that I disagree with the conclusions/advice from time to time, but the facts are right and error corrections are almost always very minor in nature.
There is good journalism out there, just maybe not from NYT. Please don't give up hope.